3 ms·
> It is better if [...anyone...] include a security warning / specific reason the code is sent with the password reset pins and similar credentials. I think an
by archi42 7y ago
> It is better if [...anyone...] include a security warning / specific reason the code is sent with the password reset pins and similar credentials.
I think anyone building such systems (either via e-mail or SMS or whatever) should at least remember THIS.
Send something like this via SMS:
> The password reset code you requested via our website is 12345. We will never ask you for this code except when you requested a password reset.
1. What is requested
2. How was it requested
3. Is it safe to pass this to some other human being
Okay, 4. in better English ;) As opposed to:
> Your caller verification code is 12345, please read this code to your banking agent to verify your identity.
Also, ChipTAN is great: https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_Sm@rt-TAN_/_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... If your bank would use this, it would be require extraordinary smart social engineering (or a really naive user).
- csunbird 7y agoHey, this is actually how it works in Turkey. All SMS messages for transaction purposes from banks have a disclaimer, which indicates whether to share the code with customer service representative or not. For example, for online transactions, the SMS includes a warning to not share the code with anyone, while SMS codes for telephone banking tells you to share the number with the representative.
- jedieaston 7y agoBofA gives a disclaimer when you have a 2FA code texted to you (still wish they supported TOTP, but whatever).
- iruoy 7y agoThe only text messages I get from my bank are descriptive confirmations of actions I did. At the end of every message it says to contact them by phone if you don't recognise the action. My bank uses a scanner to authorize pretty much all actions. It scans some sort of RGB QR code [0]. When scanned you'll see the IBAN you're sending the money to and the amount you're sending. I think that when the IBAN is in your contacts it shows the name instead of the IBAN. But most importantly it shows a descriptive message of what action you're verifying. I think the only actions that don't require the scanner are small transactions through their app and marking your card as broken/stolen in the app. [0] https://www.rabobank.nl/images/how_does_the_rabo_scanner_work_29686468.pdf https://www.rabobank.nl/images/how_does_the_rabo_scanner_wor...